CISA Flags AI Infrastructure in Latest KEV Wave: LiteLLM MCP Auth Bypass Actively Exploited
CISA Flags AI Infrastructure in Latest KEV Wave: LiteLLM MCP Auth Bypass Actively Exploited
On September 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — and for the first time, AI components made up nearly half of the batch. Three of the seven entries target AI and machine-learning infrastructure, headlined by an authentication bypass in LiteLLM, the open-source AI gateway many teams deploy as a proxy in front of their LLM APIs.
What's in the Batch
The highest-profile entry is CVE-2026-59822 (CVSS 8.8), an improper-authentication flaw in LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint. The bug allows unauthenticated attackers to establish authenticated sessions using arbitrary Bearer tokens: the OAuth2 passthrough fallback replaced failed key validation with an empty auth object, letting any crafted token reach configured MCP tooling.
The rest of the batch spans familiar infrastructure categories. Two SonicWall SMA 1000 flaws — CVE-2026-83548 (CVSS 10.0, server-side request forgery) and CVE-2026-83549 (CVSS 7.8, post-authentication OS command injection) — are under active exploitation per SonicWall. Sangoma Switchvox carries an unauthenticated SQL injection rated 9.3. JFrog Artifactory's default configuration ships a CVSS 9.8 authentication bug that hands attackers admin privileges, and Kestra OSS scores a full 10.0 for an OS command injection that lets attackers create and execute arbitrary workflows. Finally, Starlette — which arrives only as a transitive dependency under FastAPI — carries a CVSS 6.5 request-smuggling flaw, CVE-2026-48710.
The Attack Chain
What makes the batch notable is how the flaws combine. Attackers chained the Starlette request-smuggling bug with CVE-2026-42271 to bypass authentication on LiteLLM installations and drop XMRig cryptocurrency miners. From there they went after the model plumbing: the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken tables, harvesting model configuration, upstream provider keys, endpoints, and proxy-issued virtual keys, and modifying ~/.ssh/authorized_keys for persistence. Microsoft described the compromise chain as enabling shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution.
Microsoft and Wiz honeypot telemetry gathered over 90 days shows credential harvesting, reverse shells, and cryptomining against AI infrastructure, with LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers all described as lucrative targets.
What Should You Do?
- Patch on the KEV clock. Federal agencies must remediate five of the seven bugs by September 5, 2026, with the Starlette and LiteLLM flaws carrying a September 16 deadline. Agencies are also required to verify whether they were compromised before patching.
- Inventory your AI stack. If you run LiteLLM or any LLM gateway in front of provider APIs, treat it as internet-facing infrastructure — because attackers now do.
- Rotate provider keys. If a LiteLLM instance was exposed, assume upstream provider keys and virtual keys were harvested and rotate them.
- Scan lockfiles, not just CMDBs. Starlette ships beneath FastAPI and never appears in asset databases. Dependency lockfile scanning is the only reliable way to find it.
- Check persistence. Audit
authorized_keysfiles and Docker socket exposure on any AI gateway host.
The WAF Angle
AI gateways are HTTP services, and most of this batch is exploitable over the web. A WAF or API security layer in front of LiteLLM can enforce authentication on MCP endpoints, block request-smuggling patterns that abuse Starlette's parsing, and rate-limit scripted exploitation. But the deeper lesson is visibility: the Starlette blind spot — a vulnerable transitive dependency that no CMDB tracks — is exactly the kind of gap that edge monitoring can partially close, because unusual traffic to an AI proxy is a signal worth alerting on even when you don't yet know the CVE number.
